CVE-2018-3990

Vulnerability

A pool corruption vulnerability exists in the IOCTL handler for control code 0x8200E804 in WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400) [1]. The vulnerable function sub_A382D0F0 performs an out-of-bounds write when processing a specially crafted IRP request, leading to a buffer overflow in kernel pool memory [1]. The WibuKey device is accessible to all users with RW permissions, meaning any local user can send IOCTL requests to trigger this code path [1]. Affected version: WibuKey.sys 6.40 (Build 2400) on Windows 7 x86 [1].

Exploitation

An attacker must have local access to the system and the ability to send IOCTL requests to the \Device\WibuKey device [1]. No authentication or elevated privileges are required because the device is world-writable [1]. By sending a specially crafted IRP request with the 0x8200E804 control code, the attacker can cause the vulnerable function to write beyond the bounds of an allocated kernel pool buffer [1]. The exploit sequence involves constructing an IRP that triggers the overflow in the pool allocator.

Impact

Successful exploitation results in kernel memory corruption (CWE-787: Out-of-bounds Write) [1]. This corruption can lead to a denial of service or, more critically, privilege escalation from a local unprivileged user to SYSTEM level [1]. The CVSSv3 score is 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability [1].

Mitigation

As of the publication date (2019-02-05), no official patch was available from WIBU-SYSTEMS [1]. Users should monitor vendor advisories for a fix and restrict access to the WibuKey device by modifying ACLs to limit IOCTL submission to trusted users only [1]. If an update becomes available, it should be applied immediately. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.